Legal

Privacy notice

This notice covers visits to otp.systems and enquiries to RideLink about OTP. The use of RideLink apps, vehicle adapters or separately agreed platform services is subject to the relevant additional privacy notices.

1. Data controller and data protection officer

RideLink GmbH
Cassellastraße 30–32
60386 Frankfurt am Main
Germany

Telephone: +49 69 348741840
Email: [email protected]

You can contact our data protection officer, Frederic Paul, at [email protected] or by post at the above address, marked ‘Data protection officer – confidential’.

2. Providing the website and server logs

When you visit the website, your browser transmits the connection and request data needed to deliver it. Our web server logs the IP address or hostname of the requesting endpoint, time, requested address, HTTP method and version, status code, volume of data transferred and, where transmitted, referring page and browser identifier. Error logs may contain additional technical error and connection information.

The data is processed to deliver, troubleshoot and protect the website. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is a functioning, secure website.

For this draft, the hosting provider is assumed to be STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin. The operator's information and network allocation are consistent with this; the exact contracting entity still needs to be confirmed against the hosting agreement. Provider information: STRATO privacy information.

Log retention

According to the server configuration reviewed, non-empty access and error logs are rotated daily; up to 14 archived files are retained in addition to the active file. The oldest file is removed on the next rotation. With daily entries, this amounts to approximately 15 days. Days without new entries do not trigger rotation; error logs in particular may therefore be retained for longer. This setting does not guarantee a fixed maximum deletion period.

Still to be defined: binding maximum retention periods for access and error logs, justified exceptions for security incidents and retention in backups. The current technical configuration alone does not establish compliance with data protection requirements.

3. Cloudflare and technical network diagnostics

Cloudflare sits in front of the public website. The service relays requests between your browser and our server and supports content delivery and protection against attacks. Cloudflare processes, in particular, IP addresses, requested addresses, timestamps, browser information and technical security data. The provider is Cloudflare, Inc., USA, together with affiliated companies and subprocessors.

We rely on Article 6(1)(f) GDPR for provision and security. Our interest is to maintain availability and identify abusive access.

The public website currently also sends a Cloudflare policy for Network Error Logging (NEL). Supporting browsers can use this to send technical reports about failed network requests to Cloudflare. Under the setting reviewed, successful requests are not selected for these reports. Diagnostics may include the requested address, connection and error types, and timestamps; the IP address is also involved in transmission. The policy currently remains valid in the browser for up to seven days. This does not describe how long Cloudflare retains the reports.

Information: Cloudflare privacy policy and Cloudflare data processing agreement.

Still to be checked: required Cloudflare features, NEL and other access to terminal equipment under section 25 TDDDG, actual cookies, Cloudflare retention periods and the safeguards applicable to third-country transfers under this agreement. Optional diagnostics are not authorised merely by including this notice.

4. Contact and email through Microsoft 365

You can contact us by email or telephone. We process the contact details, company affiliation, message content and any attachments you provide in order to handle your enquiry. The website offers an email link; it does not itself transmit form entries. Opening the link launches your email application. You decide there whether to send a message and what to include.

Where the enquiry concerns a contract with you personally or steps before entering into that contract, the legal basis is Article 6(1)(b) GDPR. For enquiries made as a company's contact person or for general enquiries, Article 6(1)(f) GDPR applies; our interest is handling the enquiry and business communication.

We use Microsoft 365 / Exchange Online to receive, store and process email. Microsoft and its subprocessors process message content, attachments, sender and recipient addresses, and technical communication data. The specific Microsoft contracting entity and tenant settings must be checked before this notice is approved.

Microsoft documents certain processing outside the EU or EEA even for European services. The contractual safeguards provided for business customers, including standard contractual clauses, are described in the Microsoft Data Protection Addendum. This notice does not promise processing exclusively within Europe.

Retention of enquiries

Enquiry data should be deleted once the matter is concluded and the data is no longer needed for follow-up questions, unless statutory retention duties or necessary records require otherwise. Commercial correspondence subject to retention requirements generally has to be kept for six years from the end of the calendar year in which it was received or sent (section 257 HGB, German Commercial Code). The legal basis for statutory retention is Article 6(1)(c) GDPR.

The deletion, archiving and backup rules actually configured in Microsoft 365 still need to be checked against these criteria.

5. Google Analytics

With your consent, we use Google Analytics 4 to analyse website usage statistically. This helps us understand which content is used, how visitors reach us and how we can improve the information we provide.

Provider, data and purposes

Under the Google Analytics terms, the contracting party for customers in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google LLC in the United States and other Google companies may also be involved in processing.

Depending on the enabled configuration, the data processed may include page views, usage events such as clicks or scrolling, visit times and session information, referring pages, browser and device information, and approximate location. Identifiers may be used to recognise visits and sessions. This analysis should not be equated with fully anonymous processing.

Your IP address is technically processed when connecting to Google. For Google Analytics 4, Google explains that IP addresses of users in the EU are not logged or stored; they are used, among other things, to derive coarse location information and are then discarded. Other analytics information and identifiers may still be personal data. Further information: Google: EU data processing.

Consent and withdrawal

The analysis is based on your prior, freely given consent under Article 6(1)(a) GDPR. Where information is stored on or accessed from your device, section 25(1) TDDDG also applies. You can choose ‘Allow analytics’ or ‘Reject analytics’ and use the website without analytics. You can withdraw consent at any time using or the button of the same name in the footer. Withdrawal does not affect the lawfulness of processing carried out previously.

The Google tag is loaded only after consent. Before consent and following rejection, this integration sends no analytics requests to Google, including no cookieless Consent Mode pings. Withdrawal blocks further measurement, removes the known analytics cookies used by this integration insofar as they are accessible in the browser, and reloads the page to stop the active tag. Data already transmitted is not automatically deleted at Google as a result.

Cookies and retention

Google Analytics uses, in particular, the cookies _ga and _ga_VNPSDJRMSS to distinguish visitors and sessions. This integration limits the cookie lifetime to 180 days from when each cookie is set and disables automatic extension on page views. Browsers may apply shorter limits. The cookies are set for the respective website host. Information: Google: GA4 cookies.

Retention of user and event data at Google is separate from cookie lifetime. It depends, among other things, on the settings of the Analytics property used; aggregated reports may be treated differently. The actual retention setting and any extension following repeat visits still need to be confirmed. This draft does not invent a fixed period. Further information: Google: data retention.

Recipients and additional features

Google may also process data outside the EU or EEA. The data protection terms and transfer safeguards actually applicable to our Analytics agreement must be documented before this notice is approved. The general Google privacy policy and Google data processing terms describe the framework.

This integration disables Google Signals and advertising personalisation signals; no User-ID is sent. Consent for advertising storage, advertising user data and advertising personalisation remains denied.

Still to be checked: Google property and Google tag settings, particularly enhanced measurement, data sharing, linked destinations or Google Ads connections, events, retention and transfers. Additional services or advertising purposes require a separate assessment and, where necessary, their own consent.

6. Cookies and consent

Technically necessary delivery and security functions must be distinguished from optional usage analytics and advertising. Google Analytics cookies are covered in the preceding section. Cloudflare processing, including network diagnostics, is described in section 3. Based on the operator's information, a blanket statement that this website uses no cookies or analytics technologies would be inaccurate.

Prior consent under section 25(1) TDDDG is generally required for storage on or access to your device that is not strictly necessary. The exceptions in section 25(2) TDDDG apply only where their conditions are met. Consent must be freely given and sufficiently specific; it must not be inferred from preselected optional categories or merely continuing to browse.

Your choice is saved as otp_consent_v1 in your browser's local storage. The entry contains your analytics choice, version number, selection time and expiry time; it contains no separately assigned visitor identifier and is not sent to our server as a consent record. After 180 days, the choice is no longer valid and you are asked again. You can change it at any time through ‘Cookie settings’. Analytics remains disabled if local storage is blocked or unavailable.

This storage is necessary to implement and respect your requested privacy choice (section 25(2), no. 2 TDDDG). Insofar as personal data is processed, we rely on Article 6(1)(f) GDPR; our interest is to respect your decision reliably. Clearing browser storage removes the saved choice. You can send privacy questions to [email protected]. The choice controls this Google Analytics integration; Cloudflare and its network diagnostics are described separately in section 3.

Images, stylesheets and the basic site scripts are delivered under the website's address. Ordinary external links open independent services; the respective provider's privacy information also applies when you visit them.

7. Planned marketing technologies

A Meta/Facebook pixel is being considered for a later extension. Under current plans, it is not part of the analytics described here. This notice neither activates a pixel nor obtains consent for a future service.

Before actual use, the specific Meta service, responsibilities, data and events, recipients, purposes such as advertising performance measurement or audience creation, retention periods and third-country transfers must be described. Marketing technologies must remain blocked until the required consent is given. Consent for Google Analytics does not automatically cover a Meta pixel or other advertising services added later.

8. Recipients and transfers to third countries

Persons handling the enquiry or technical operations and the IT service providers named above receive access to the extent necessary. Authorities or other bodies receive data where required by law. Where service providers act as processors, an agreement under Article 28 GDPR is required.

Transfers to countries outside the EU or EEA must meet the requirements of Articles 44 et seq. GDPR, for example through an applicable adequacy decision or appropriate safeguards. The specific basis applying to the Google, Cloudflare and Microsoft agreements in use still needs to be documented for this draft. Information and, where applicable, a copy of the relevant safeguards can be requested from the privacy contact.

9. Your rights

Where the statutory conditions are met, you have the right to access, rectification, erasure, restriction of processing and data portability. You can withdraw consent at any time with effect for the future; this does not affect previous processing.

To exercise your rights, contact [email protected]. Appropriate verification of your identity may be necessary to handle the request.

Complaint to a supervisory authority

You can lodge a complaint with a data protection supervisory authority, particularly in the place of your habitual residence, workplace or an alleged infringement. The authority responsible for our registered office is the Hessian Commissioner for Data Protection and Freedom of Information:

Postfach 3163
65021 Wiesbaden
Lodge a complaint with the Hessian data protection authority

10. Voluntary contact and automated decisions

Contacting us is voluntary. Without a working contact address and the information needed to clarify the matter, we may be unable to respond. The technical data necessary for transmission arises when you visit the website. We do not use solely automated decisions with legal or similarly significant effects for business enquiries through this website.

Last updated: 19 September 2026